This vulnerability in GNOME localsearch (tracker-miners) MP3 Extractor arises from a missing bounds check in the extract_performers_tags function when handling ID3v2.4 tags in MP3 files. The flaw can cause a heap buffer overflow, enabling a remote attacker to trigger a denial of service by reading unmapped memory. Additionally, it may lead to information disclosure by reading visible heap data. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. No official patch or remediation level is stated in the vendor advisory as of the publication date. The vendor advisory link is provided for updates.

The vulnerability allows a remote attacker with local access and low privileges to cause a denial of service by triggering out-of-bounds reads leading to heap buffer overflow. This can crash the affected process. In some cases, it may also disclose information from the heap memory. There is no indication of integrity compromise. The impact is rated medium with a CVSS score of 5.6.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1764 for current remediation guidance. No official fix or workaround is indicated in the provided advisory content. Users should monitor the vendor advisory for updates and apply patches once available.